PT-2026-43972 · Libusb · Libusb

Marklee131 · Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-47104

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libusb versions prior to 1.0.30

Description A one-byte out-of-bounds read exists in the parse iad array() function within descriptor.c. This occurs when a malformed USB descriptor is supplied where the bLength equals the size minus one, causing the bounds check to utilize the original buffer size rather than the remaining size. In virtualized environments with USB passthrough, attackers can use the functions libusb get active interface association descriptors or libusb get interface association descriptors to provide crafted descriptors, reading one byte past the end of the malloc allocation and triggering a denial of service.

Recommendations Update to version 1.0.30 or later.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-47104

Affected Products

Libusb

References · 7

• https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 · Patch
• https://github.com/libusb/libusb/pull/1814 · Patch
• https://vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47104 · Security Note
• https://github.com/libusb/libusb/releases/tag/v1.0.30 · Note
• https://github.com/libusb/libusb/issues/1813 · Note
• https://t.me/cveNotify/165024 · Telegram Post